Critical Form Send to HTTP
Severity: Medium
Summary #
Invicti detected that a critical form's action is targetted an HTTP resource.
Impact #
If an attacker can intercept network traffic, he/she can steal users' credentials. In this case even though the form is served over HTTPS, it'll be submitted to an HTTP resource. This defeats the purpose of SSL protection for this form.
Actions To Take #
- See the remedy for solution.
- Move all of your critical forms to HTTPS and ensure their form actions are targetting HTTPS.
Remediation #
All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over and form actions also should target HTTPS. All aspects of the application that accept user input, starting from the login process, should only be served over HTTPS.
Classifications #
PCI v3.1-6.5.4; PCI v3.2-6.5.4; CAPEC-65; CWE-319; ISO27001-A.14.1.3; WASC-4; OWASP 2013-A6; OWASP 2017-A3
, CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
